lore-server: Enforce repository write permissions

[s-zaizen]

Summary

Enforces repository permission claims for authorization and write paths in lore-server.

Repository authorization now requires a matching repository resource to include a read-like permission, and repository mutation paths require write, admin, owner.

Details

Repository authorization was based on whether a token contained a matching repository resource, but missing or empty permission lists were still treated as authorized. This allowed resource claims without repository permissions to pass authorization checks.

This updates the shared JWT authorization helpers and applies write checks across

• gRPC revision, repository metadata, and storage mutation handlers
• HTTP content writes
• protocol storage put/copy/mutable operations
• QUIC storage sessions and write commands

Testing

cargo +nightly fmt --all --check
cargo build
cargo clippy --all-targets -- -D warnings --no-deps
cargo test -p lore-server